Fog-based hybrid system for optimal distribution of anomaly detection and remediation services

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• reserve first and second sets of local resources for an anomaly detection mechanism;
• report the first set of local resources to a supervisory node in the network;
• apply one or more anomaly detection rules from the supervisory node using the first set of reserved resources;
• receive one or more anomaly detection rules from a peer node in the network;
• and
• apply the one or more anomaly detection rules from the peer node using the second set of reserved resources.

A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor operable to:

• reserve first and second sets of local resources for an anomaly detection mechanism;
• report the first set of local resources to a supervisory node in the network;
• apply one or more anomaly detection rules from the supervisory node using the first set of reserved resources;
• receive one or more anomaly detection rules from a peer node in the network;
• and
• apply the one or more anomaly detection rules from the peer node using the second set of reserved resources.